openmausbot 0.1.93 → 0.1.95

package/dist-server/shared/live-call.js

@@ -0,0 +1,176 @@
+// Pure pieces of a Live (GPT-Live) call, kept out of the component so they
+// can be tested without WebRTC.
+//
+// With client delegation GPT-Live says *that* it wants help, never *what*:
+// `session.delegation.created` carries an id and a timeline offset, and the
+// request has to be rebuilt from the input transcript. That reconstruction,
+// and the shaping of the bot's answer into the 500-token appends GPT-Live
+// accepts, live here.
+/** Collects `session.input_transcript.delta` fragments on the session
+ * timeline. Fragments are appended in delivery order, as the API asks. */
+export class LiveTranscript {
+    input = [];
+    /** when the voice itself was speaking, on the same timeline */
+    output = [];
+    cutoffMs = -1;
+    addInput(text, startMs, endMs) {
+        if (!text)
+            return;
+        this.input.push({ text, startMs: Number.isFinite(startMs) ? startMs : 0, endMs: Number.isFinite(endMs) ? endMs : 0 });
+        // keep memory bounded on long calls: only the unconsumed tail matters
+        if (this.input.length > 2_000)
+            this.input = this.input.filter((segment) => segment.startMs > this.cutoffMs);
+    }
+    /** A stretch of the voice's own speech (a `session.output_transcript.delta`
+     * with its timing). Input heard during it may be the voice itself, picked
+     * up again by the microphone of a phone on speaker. Deltas without timing
+     * are ignored. */
+    addOutput(startMs, endMs) {
+        if (!Number.isFinite(startMs) || !Number.isFinite(endMs) || endMs < startMs)
+            return;
+        const last = this.output.at(-1);
+        if (last && startMs <= last.endMs)
+            last.endMs = Math.max(last.endMs, endMs);
+        else
+            this.output.push({ startMs, endMs });
+        if (this.output.length > 500)
+            this.output.splice(0, this.output.length - 500);
+    }
+    /** The words spoken since the previous request, up to a little past the
+     * delegation point (transcription can trail the delegation event, and the
+     * person may finish the sentence that triggered it). Consumes them, so the
+     * next request starts after this one. */
+    takeRequest(offsetMs, graceMs = 1_500) {
+        return this.takeRequestParts(offsetMs, graceMs).text;
+    }
+    /** takeRequest, plus the same words without those heard while the voice
+     * spoke (`withoutEcho`), for reading a spoken yes/no. Consumes all of them. */
+    takeRequestParts(offsetMs, graceMs = 1_500) {
+        const until = offsetMs + graceMs;
+        const taken = this.input.filter((segment) => segment.startMs > this.cutoffMs && segment.startMs <= until);
+        if (!taken.length)
+            return { text: "", withoutEcho: "" };
+        this.cutoffMs = Math.max(this.cutoffMs, ...taken.map((segment) => segment.startMs));
+        return {
+            text: joinFragments(taken.map((segment) => segment.text)),
+            withoutEcho: joinFragments(taken.filter((segment) => !this.echoed(segment)).map((segment) => segment.text)),
+        };
+    }
+    /** Everything heard since the last taken request, without consuming it —
+     * used to read a spoken yes/no while a permission question is open.
+     * `skipEcho` leaves out what was heard while the voice itself spoke. */
+    pending(options = {}) {
+        return joinFragments(this.input
+            .filter((segment) => segment.startMs > this.cutoffMs && !(options.skipEcho && this.echoed(segment)))
+            .map((segment) => segment.text));
+    }
+    echoed(segment) {
+        return this.output.some((span) => segment.startMs < span.endMs && segment.endMs > span.startMs);
+    }
+    /** Mark everything heard so far as handled (e.g. after a spoken decision). */
+    consumeAll() {
+        for (const segment of this.input)
+            this.cutoffMs = Math.max(this.cutoffMs, segment.startMs);
+    }
+}
+/** Transcript deltas are fragments of words, not words: glue them as sent. */
+export function joinFragments(fragments) {
+    return fragments.join("").replace(/\s+/g, " ").trim();
+}
+/** GPT-Live caps each append at 500 tokens. A 500 UTF-8 byte budget is
+ * conservative even for emoji/CJK, unlike a prose-only character estimate.
+ * Byte-level tokenization cannot produce more tokens than input bytes. */
+const APPEND_BYTE_LIMIT = 500;
+const encoder = new TextEncoder();
+const bytes = (text) => encoder.encode(text).length;
+/** Standard UTF-8 accounting; stop at a complete code point, not a surrogate. */
+function bytePrefix(text, budget) {
+    return new TextDecoder().decode(encoder.encode(text).subarray(0, budget), { stream: true });
+}
+const MAX_SPOKEN_CHUNKS = 3;
+export const FULL_ANSWER_IN_CHAT = "The full answer is in the chat.";
+/** Group speakable utterances (from /api/tts/prepare) into appends. Long
+ * answers are cut at a sentence boundary with a pointer to the chat, because
+ * a voice reading four minutes of a report is not a conversation. */
+export function commentaryChunks(utterances) {
+    const chunks = [];
+    let current = "";
+    let truncated = false;
+    for (const raw of utterances) {
+        const utterance = raw.replace(/\s+/g, " ").trim();
+        if (!utterance)
+            continue;
+        const pieces = bytes(utterance) > APPEND_BYTE_LIMIT ? splitLong(utterance) : [utterance];
+        for (const piece of pieces) {
+            if (current && bytes(current) + 1 + bytes(piece) > APPEND_BYTE_LIMIT) {
+                chunks.push(current);
+                current = "";
+            }
+            if (chunks.length >= MAX_SPOKEN_CHUNKS) {
+                truncated = true;
+                break;
+            }
+            current = current ? `${current} ${piece}` : piece;
+        }
+        if (truncated)
+            break;
+    }
+    if (current && chunks.length < MAX_SPOKEN_CHUNKS)
+        chunks.push(current);
+    else if (current)
+        truncated = true;
+    if (truncated && chunks.length) {
+        const last = chunks[chunks.length - 1];
+        chunks[chunks.length - 1] = bytes(last) + 1 + bytes(FULL_ANSWER_IN_CHAT) <= APPEND_BYTE_LIMIT
+            ? `${last} ${FULL_ANSWER_IN_CHAT}`
+            : `${bytePrefix(last, APPEND_BYTE_LIMIT - bytes(FULL_ANSWER_IN_CHAT) - 1).replace(/\s+\S*$/, "")} ${FULL_ANSWER_IN_CHAT}`;
+    }
+    return chunks;
+}
+function splitLong(text) {
+    const out = [];
+    let rest = text;
+    while (bytes(rest) > APPEND_BYTE_LIMIT) {
+        const window = bytePrefix(rest, APPEND_BYTE_LIMIT);
+        const sentence = Math.max(window.lastIndexOf(". "), window.lastIndexOf("! "), window.lastIndexOf("? "));
+        const space = window.lastIndexOf(" ");
+        const cut = sentence > window.length / 2 ? sentence + 1 : space > 0 ? space : window.length;
+        out.push(rest.slice(0, cut).trim());
+        rest = rest.slice(cut).trim();
+    }
+    if (rest)
+        out.push(rest);
+    return out;
+}
+/** Keep appended content inside the per-append limit. */
+export function clampAppend(content) {
+    const text = content.replace(/\s+/g, " ").trim();
+    return bytes(text) <= APPEND_BYTE_LIMIT ? text : `${bytePrefix(text, APPEND_BYTE_LIMIT - bytes("…")).replace(/\s+\S*$/, "")}…`;
+}
+/** GPT-Live voices from OpenAI's documentation (Managing GPT-Live sessions,
+ * "Voice options", and the SDK's BuiltInVoice list), with the regional
+ * notes the docs give for the additional ones. */
+export const LIVE_VOICE_OPTIONS = [
+    { id: "marin", label: "Marin (default)" },
+    { id: "cedar", label: "Cedar" },
+    { id: "alloy", label: "Alloy" },
+    { id: "ash", label: "Ash" },
+    { id: "ballad", label: "Ballad" },
+    { id: "coral", label: "Coral" },
+    { id: "echo", label: "Echo" },
+    { id: "sage", label: "Sage" },
+    { id: "shimmer", label: "Shimmer" },
+    { id: "verse", label: "Verse" },
+    { id: "gleam", label: "Gleam — North American, feminine" },
+    { id: "meridian", label: "Meridian — North American, masculine" },
+    { id: "quartz", label: "Quartz — Australian, feminine" },
+    { id: "ripple", label: "Ripple — Australian, masculine" },
+    { id: "vesper", label: "Vesper — British, masculine" },
+    { id: "willow", label: "Willow — Irish, feminine" },
+    { id: "stone", label: "Stone — Irish, masculine" },
+    { id: "delta", label: "Delta — Southern U.S., feminine" },
+    { id: "cinder", label: "Cinder — Southern U.S., masculine" },
+    { id: "beacon", label: "Beacon — Filipino, masculine" },
+    { id: "bossa", label: "Bossa — Brazilian Portuguese, feminine" },
+    { id: "tempo", label: "Tempo — Brazilian Portuguese, masculine" },
+];

package/dist-server/shared/outbound.js

@@ -0,0 +1,128 @@
+// Outbound actions: the calls that reach a person outside the app, or move
+// money. Sending an email, replying in a thread, posting to a channel,
+// publishing, inviting, sharing, refunding, charging. These get their own
+// confirmation regardless of approval level, and an optional daily
+// allowance per bot, because the cost of one wrong send is paid by someone
+// who never saw the bot.
+//
+// Shared between the harness (which enforces it) and the app (which shows
+// the setting), so both agree on what "outbound" means.
+export const OUTBOUND_DEFAULT_CAP = 25;
+const OUTBOUND_MAX_CAP = 1_000;
+/** Tools whose action is one of these words send something somewhere. */
+const SEND_VERBS = new Set([
+    "SEND",
+    "SENDS",
+    "REPLY",
+    "RESPOND",
+    "FORWARD",
+    "POST",
+    "PUBLISH",
+    "TWEET",
+    "RETWEET",
+    "BROADCAST",
+    "INVITE",
+    "SHARE",
+    "REFUND",
+    "CHARGE",
+    "PAY",
+    "PAYOUT",
+    "TRANSFER",
+]);
+/** Creating one of these is sending it: a created comment is a comment
+ * someone reads, a created invoice is one someone receives. */
+const CREATE_VERBS = new Set(["CREATE", "CREATION", "ADD", "NEW"]);
+const SENT_NOUNS = new Set(["MESSAGE", "COMMENT", "POST", "EMAIL", "MAIL", "INVOICE", "PAYMENT", "REFUND", "REPLY", "TWEET", "DM"]);
+/** A read verb first means the rest of the name is what is being read:
+ * REDDIT_GET_POST fetches a post, it does not post. */
+const READ_VERBS = new Set(["GET", "LIST", "FETCH", "SEARCH", "READ", "FIND", "RETRIEVE", "LOOKUP", "DOWNLOAD", "VIEW", "CHECK", "COUNT"]);
+/** The action part of a tool name, as upper-case word tokens. Composio's
+ * TOOLKIT_ACTION drops its toolkit; an MCP server's mcp__server__action
+ * drops its server; a bare built-in like Bash stays as it is. */
+function actionTokens(name) {
+    let action = name;
+    if (name.startsWith("mcp__")) {
+        const [, server = "", ...rest] = name.split("__");
+        action = rest.join("_");
+        if (server === "composio")
+            return actionTokens(action);
+    }
+    else if (/^[A-Z][A-Z0-9]*_[A-Z0-9_]+$/.test(name)) {
+        action = name.slice(name.indexOf("_") + 1);
+    }
+    return action
+        .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
+        .toUpperCase()
+        .split(/[^A-Z0-9]+/)
+        .filter(Boolean);
+}
+/** Does this tool send something to someone, or move money? */
+export function isOutboundTool(name) {
+    // A raw API call from the workbench can do anything an app tool can, and
+    // nothing here can read which; it is treated as a send.
+    if (name === "COMPOSIO_PROXY_EXECUTE")
+        return true;
+    const tokens = actionTokens(name);
+    if (tokens.length === 0)
+        return false;
+    if (READ_VERBS.has(tokens[0]))
+        return false;
+    if (tokens.some((token) => SEND_VERBS.has(token)))
+        return true;
+    if (tokens.includes("DRAFT"))
+        return false;
+    return tokens.some((token) => CREATE_VERBS.has(token)) && tokens.some((token) => SENT_NOUNS.has(token));
+}
+/** The stored shape, or null when the value is not one. */
+export function normalizeOutboundPolicy(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const { policy, dailyCap } = value;
+    if (policy !== "ask" && policy !== "allow")
+        return null;
+    if (dailyCap === undefined)
+        return { policy, dailyCap: OUTBOUND_DEFAULT_CAP };
+    if (typeof dailyCap !== "number" || !Number.isInteger(dailyCap) || dailyCap < 1 || dailyCap > OUTBOUND_MAX_CAP)
+        return null;
+    return { policy, dailyCap };
+}
+/** What a bot without a stored policy does: ask, every time. */
+export const DEFAULT_OUTBOUND_POLICY = { policy: "ask", dailyCap: OUTBOUND_DEFAULT_CAP };
+const isRecord = (value) => Boolean(value) && typeof value === "object" && !Array.isArray(value);
+/** Composio's session exposes a handful of meta tools and runs the app
+ * tools inside them: a multi-execute call carries a list of slugs with
+ * arguments. Arbitrary workbench/bash code is opaque: it requires an
+ * explicit unrestricted approval, never an inferred app or send count.
+ * Search, schema lookup, and connection management run no app tools. */
+export function connectorCallsIn(name, args) {
+    if (name === "COMPOSIO_MULTI_EXECUTE_TOOL") {
+        const tools = isRecord(args) && Array.isArray(args.tools) ? args.tools
+            : isRecord(args) && typeof args.tool_slug === "string" ? [args] : [];
+        if (!tools.length)
+            return [{ slug: "COMPOSIO_PROXY_EXECUTE", arguments: args }];
+        const calls = [];
+        for (const item of tools) {
+            if (!isRecord(item))
+                return [{ slug: "COMPOSIO_PROXY_EXECUTE", arguments: args }];
+            const slug = [item.tool_slug, item.slug, item.name, item.tool].find((value) => typeof value === "string" && value);
+            if (typeof slug !== "string")
+                return [{ slug: "COMPOSIO_PROXY_EXECUTE", arguments: args }];
+            calls.push({ slug, ...(item.arguments !== undefined ? { arguments: item.arguments } : {}) });
+        }
+        return calls;
+    }
+    if (name === "COMPOSIO_REMOTE_WORKBENCH" || name === "COMPOSIO_REMOTE_BASH_TOOL") {
+        // Arbitrary code can compute tool names and repeat calls. Its app and
+        // outbound count cannot be inferred from literals in the source.
+        return [{ slug: "COMPOSIO_PROXY_EXECUTE", arguments: args }];
+    }
+    if (["COMPOSIO_SEARCH_TOOLS", "COMPOSIO_GET_TOOL_SCHEMAS", "COMPOSIO_MANAGE_CONNECTIONS", "COMPOSIO_WAIT_FOR_CONNECTIONS"].includes(name))
+        return [];
+    if (name.startsWith("COMPOSIO_"))
+        return [{ slug: "COMPOSIO_PROXY_EXECUTE", arguments: args }];
+    return [{ slug: name, ...(args !== undefined ? { arguments: args } : {}) }];
+}
+/** The subset of a request's app tools that would send something. */
+export function outboundCallsIn(name, args) {
+    return connectorCallsIn(name, args).filter((call) => isOutboundTool(call.slug));
+}

package/dist-server/shared/skill-md.js

@@ -13,6 +13,15 @@ export const SKILL_FILE_MAX_BYTES = 256 * 1024;
 export function isSkillName(name) {
     return name.length >= 1 && name.length <= SKILL_NAME_MAX && SKILL_NAME.test(name);
 }
+/** Browsing tags: lowercase slug-ish words, short enough for chip rows. */
+const TAG_PATTERN = /^[a-z0-9][a-z0-9-]{0,23}$/;
+export const SKILL_TAGS_MAX = 8;
+export function parseSkillTags(raw) {
+    if (!raw)
+        return undefined;
+    const tags = [...new Set(raw.split(",").map((tag) => tag.trim().toLowerCase()).filter((tag) => TAG_PATTERN.test(tag)))].slice(0, SKILL_TAGS_MAX);
+    return tags.length > 0 ? tags : undefined;
+}
 /** Minimal frontmatter reader for the two required keys plus the two we
  * display. Deliberately not a YAML engine: values are single-line strings in
  * every skill the spec's own examples show, and a parser that cannot
@@ -41,6 +50,7 @@ export function parseSkillMd(raw) {
         description,
         license: fields.license || undefined,
         compatibility: fields.compatibility || undefined,
+        tags: parseSkillTags(fields.tags),
         body: match[2] ?? "",
     };
 }

package/dist-server/shared/team-backup.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { CONNECTOR_SLUG_PATTERN, CONNECTOR_TOOL_NAME_PATTERN } from "./wire.js";
+import { parseToolScope } from "./tool-scope.js";
 export const MAX_TEAM_BACKUP_BYTES = 50 * 1024 * 1024;
 export const TEAM_BACKUP_CONTENTS = "Bot profiles, instructions, sections, rooms, playbooks, routines, each bot's memory (MEMORY.md, topic notes and daily logs) and conversation text (all tasks and branches).";
 export const TEAM_BACKUP_EXCLUSIONS = "Files, images, custom avatars, account connections, model settings and permissions are not included. Action cards are saved as text. Memory is saved with secrets removed. Imported routines start paused.";
@@ -98,6 +99,8 @@ const backupSchema = z.object({
         hidden: z.boolean(),
         playbooks: z.array(playbook).max(200),
         connectorTools: connectorTools.optional(),
+        toolScope: z.custom((value) => value !== undefined && parseToolScope(value).ok, "Invalid tool selection")
+            .transform((value) => { const parsed = parseToolScope(value); return parsed.ok ? parsed.scope : value; }).optional(),
         memory: memory.optional(),
     })).min(1).max(200),
     groups: z.array(z.preprocess(knownRoomResponder, z.object({

package/dist-server/shared/tool-scope-support.js

@@ -0,0 +1,25 @@
+import { narrowsNativeTools, parseToolScope } from "./tool-scope.js";
+/** Native contracts and app-supplied MCP gates are separate capabilities. */
+export const TOOL_SCOPE_SUPPORT = {
+    grok: "native-and-mcp", grokAgent: "native-and-mcp", piAgent: "native-and-mcp",
+    "openai-compat": "native-and-mcp", mistral: "native-and-mcp", minimax: "native-and-mcp", cerebras: "native-and-mcp",
+    claudeAgent: "mcp", codex: "mcp", geminiAgent: "mcp", kimiAgent: "mcp", droidAgent: "mcp",
+    cursorAgent: "mcp", opencodeGo: "mcp", qwenAgent: "mcp", hermesAgent: "mcp", customAcp: "mcp", antigravityAgent: "mcp",
+    boxAgent: "none",
+};
+export function assertToolScopeSupported(engine, value) {
+    const parsed = parseToolScope(value);
+    if (!parsed.ok)
+        throw new Error(parsed.error);
+    const support = TOOL_SCOPE_SUPPORT[engine];
+    if (parsed.scope !== undefined && support !== "native-and-mcp") {
+        if (support === "none" || support === undefined) {
+            if (parsed.scope.allow !== undefined || parsed.scope.deny?.length)
+                throw new Error(`${engine}: tool selection is not supported by this engine. Choose a supported engine.`);
+        }
+        else if (narrowsNativeTools(parsed.scope)) {
+            throw new Error(`${engine}: native tool selection is not supported by this engine. Keep native:* in the selection or choose a supported engine.`);
+        }
+    }
+    return parsed.scope;
+}

package/dist-server/shared/tool-scope.js

@@ -0,0 +1,136 @@
+const SERVER_NAME = /^[a-z][a-z0-9_-]{0,31}$/;
+// Selectors must never contain protocol control characters.
+// eslint-disable-next-line no-control-regex
+const CONTROL_CHARACTER = /[\x00-\x1f\x7f]/;
+const MAX_SELECTORS = 256;
+const MAX_SELECTOR_LENGTH = 1024;
+function validName(name) {
+    return typeof name === "string" && name.trim().length > 0
+        && name.length <= MAX_SELECTOR_LENGTH && !CONTROL_CHARACTER.test(name)
+        && !name.includes("*");
+}
+function selectorIdentity(selector) {
+    if (selector.length > MAX_SELECTOR_LENGTH || CONTROL_CHARACTER.test(selector))
+        return;
+    if (selector.startsWith("native:")) {
+        const name = selector.slice(7);
+        if (name === "*" || validName(name))
+            return { kind: "native", name };
+    }
+    else if (selector.startsWith("mcp:")) {
+        const separator = selector.indexOf(":", 4);
+        if (separator < 0)
+            return;
+        const server = selector.slice(4, separator);
+        const name = selector.slice(separator + 1);
+        if (SERVER_NAME.test(server) && (name === "*" || validName(name))) {
+            return { kind: "mcp", server, name };
+        }
+    }
+}
+/** Undefined inherits the existing catalog. A present invalid value never does. */
+export function parseToolScope(value) {
+    if (value === undefined)
+        return { ok: true, scope: undefined };
+    const invalid = { ok: false, error: "Tool selection must contain only valid allow and deny lists." };
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return invalid;
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null)
+        return invalid;
+    const scope = {};
+    for (const key of Reflect.ownKeys(value)) {
+        if (key !== "allow" && key !== "deny")
+            return invalid;
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        if (!descriptor || !("value" in descriptor))
+            return invalid;
+        const list = descriptor.value;
+        if (!Array.isArray(list) || list.length > MAX_SELECTORS)
+            return invalid;
+        // Array.from exposes holes as undefined instead of silently skipping them.
+        if (!Array.from(list).every((entry) => typeof entry === "string" && selectorIdentity(entry)))
+            return invalid;
+        scope[key] = [...new Set(list)];
+    }
+    return { ok: true, scope };
+}
+function matches(selector, tool) {
+    const selected = selectorIdentity(selector);
+    return selected?.kind === tool.kind
+        && (selected.kind !== "mcp" || (tool.kind === "mcp" && selected.server === tool.server))
+        && (selected.name === "*" || selected.name === tool.name);
+}
+function permits(scope, tool) {
+    if (!validName(tool.name) || (tool.kind === "mcp" && !SERVER_NAME.test(tool.server)))
+        return false;
+    return (scope?.allow === undefined || scope.allow.some((selector) => matches(selector, tool)))
+        && !scope?.deny?.some((selector) => matches(selector, tool));
+}
+export function allowsTool(scope, tool) {
+    const parsed = parseToolScope(scope);
+    return parsed.ok && permits(parsed.scope, tool);
+}
+/** Whether an engine needs a native catalog contract, in addition to MCP gates. */
+export function narrowsNativeTools(value) {
+    const parsed = parseToolScope(value);
+    if (!parsed.ok)
+        return true;
+    const scope = parsed.scope;
+    return scope !== undefined && ((scope.allow !== undefined && !scope.allow.includes("native:*"))
+        || Boolean(scope.deny?.some((selector) => selector.startsWith("native:"))));
+}
+/** Without a catalog, asks whether this server could have a permitted tool. */
+export function canUseMcpServer(scope, server, names) {
+    const parsed = parseToolScope(scope);
+    if (!parsed.ok || !SERVER_NAME.test(server))
+        return false;
+    if (names !== undefined) {
+        return names.some((name) => permits(parsed.scope, { kind: "mcp", server, name }));
+    }
+    if (parsed.scope?.deny?.includes(`mcp:${server}:*`))
+        return false;
+    if (parsed.scope?.allow === undefined)
+        return true;
+    return parsed.scope.allow.some((selector) => {
+        const selected = selectorIdentity(selector);
+        return selected?.kind === "mcp" && selected.server === server
+            && (selected.name === "*" || permits(parsed.scope, selected));
+    });
+}
+/** Compare the selector partitions, including a tool/server outside all exact names. */
+export function toolScopeWidens(previous, next) {
+    const before = parseToolScope(previous);
+    const after = parseToolScope(next);
+    if (!after.ok)
+        return false;
+    const namespaces = new Map([["native", new Set()]]);
+    const scopes = [before.ok ? before.scope : undefined, after.scope];
+    for (const scope of scopes) {
+        for (const selector of [...(scope?.allow ?? []), ...(scope?.deny ?? [])]) {
+            const tool = selectorIdentity(selector);
+            const namespace = tool.kind === "native" ? "native" : `mcp:${tool.server}`;
+            if (!namespaces.has(namespace))
+                namespaces.set(namespace, new Set());
+            if (tool.name !== "*")
+                namespaces.get(namespace).add(tool.name);
+        }
+    }
+    let server = "unlisted";
+    for (let i = 0; namespaces.has(`mcp:${server}`); i++)
+        server = `unlisted${i}`;
+    namespaces.set(`mcp:${server}`, new Set());
+    for (const [namespace, names] of namespaces) {
+        let other = "__unlisted_tool__";
+        for (let i = 0; names.has(other); i++)
+            other = `__unlisted_tool_${i}__`;
+        names.add(other);
+        for (const name of names) {
+            const tool = namespace === "native" ? { kind: "native", name }
+                : { kind: "mcp", server: namespace.slice(4), name };
+            if (permits(after.scope, tool) && (!before.ok || !permits(before.scope, tool)))
+                return true;
+        }
+    }
+    return false;
+}

package/dist-server/shared/tool-surface.js

@@ -7,8 +7,9 @@
  * computer is illustrated only after one of these; the built-in browser's
  * read-only calls (snapshot, read, get_text, waits) stay out by the same rule. */
 export const SCREEN_TOUCHING_TOOLS = new Set([
-    // cloud boat / remote computer
-    "screenshot", "click", "type_text", "press_key", "scroll", "computer_batch", "open_url", "browser_click", "browser_fill",
+    // cloud boat / remote computer (server/cloud-computer-tools.ts names its
+    // key tool key_press)
+    "screenshot", "click", "type_text", "press_key", "key_press", "scroll", "computer_batch", "open_url", "browser_click", "browser_fill",
     // built-in browser: the Electron surface's names, kept because a bot on an
     // older remote harness can still call them
     "browser_navigate", "browser_type", "browser_press", "browser_scroll", "browser_hover", "browser_drag",